Privacy Policy

This Privacy Policy explains how MortgageLens ("we", "us", "our") collects, uses, and protects your personal information when you use our website at mortgagelens.co.uk (the "Site"). It is written to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

MortgageLens is operated by Bytes Reality Ltd, a company registered in England and Wales.

• Company number: 13192209
• Registered address: 175 High Street, Barnet, England, EN5 5SU
• General contact: info@mortgagelens.co.uk
• Privacy contact: privacy@bytesreality.com

Bytes Reality Ltd is the data controller for personal information collected through the Site.

2. Summary — what data we collect and why

We have designed the Site so that you can use most features without giving us any personal information. Calculators, property price pages, guides, and interest rate data are all available without sign-up.

We only collect personal data when you choose to use a feature that requires it. The features that collect personal data are described in section 3 below. We also collect a small amount of analytics data about how the Site is used, described in section 4.

3. Personal data we collect

3.1 Contact form

When you submit our contact form (/contact), we collect:

• Your name
• Your email address
• The subject and content of your message
• Your IP address and a timestamp (used for rate limiting and abuse prevention)

Lawful basis: Article 6(1)(b) — necessary to take steps at your request before or in connection with a contract or service, and Article 6(1)(f) — our legitimate interest in responding to enquiries and preventing abuse of the form.

3.2 Mortgage broker enquiry form

If you choose to use our broker enquiry form (/find-professionals), we collect:

• Your name
• Your email address
• Your phone number (optional)
• Buyer type (e.g. first-time buyer, remortgage)
• Indicative timeline for needing a mortgage
• Property price and deposit amount you entered into a calculator (if you came from one)
• Your IP address, user-agent and a timestamp

Lawful basis: Article 6(1)(a) — your consent, given by ticking the consent checkbox and submitting the form. You can withdraw this consent at any time (see section 8).

How we use it: we will pass your enquiry to a qualified, FCA-regulated mortgage broker who can give you personalised advice. The broker will become a separate data controller for your information at the point we share it with them, and they will have their own privacy notice that governs their use of your data.

3.3 Mortgage Summary Report

Our Mortgage Summary Report tool (/mortgage-report) is a guided wizard that produces a PDF summary of a mortgage application — typically used as a starter pack to take to a broker. Because it is designed to mirror a broker fact-find, it can collect a wide range of personal and financial information that you choose to provide, including:

• Your name, date of birth, current and previous addresses, time at address, dependants
• Employment status, employer, job title, contract type, length of employment
• Income: salary, bonus, commission, overtime; self-employed net profit; rental, investment, benefits and maintenance income
• Monthly outgoings: credit card balances, loans, car finance, student loans, child maintenance, childcare and other commitments
• Property details: address, price, type, tenure and lease information
• Mortgage requirements: deposit amount and source, repayment type, rate preferences
• Credit history disclosures: bankruptcy, CCJs, defaults, arrears (only if you choose to enter them)

How the data is stored: your report data is stored in our database against a unique session token. The PDF is generated server-side and stored in a secure file store (Vercel Blob) so you can download it.

Lawful basis: Article 6(1)(b) — necessary to provide the report you have requested. Some of this information may be sensitive (for example credit history). We collect it only because you have actively chosen to enter it into a tool that is clearly designed to capture it.

Retention: Mortgage report data is retained for a maximum of 90 days from creation in broker mode, and 7 days for the default buyer mode. After that period an automated daily job deletes the database row and the underlying PDF file. If you would like your data deleted sooner, contact us at the email above.

We do not share your report data with anyone unless you explicitly choose to share the PDF link with a broker or third party of your choice. The link is bearer-token based, so anyone with the link can view the report — please share it carefully.

3.4 Embed / Offers signup (for businesses)

If you sign up for an embed account at /offers, we collect your business name, email address and website domain. If you subscribe to a paid plan, payment is processed by Stripe; we do not store your card details — see section 5.

Lawful basis: Article 6(1)(b) — necessary to provide the embed service or subscription you have requested.

4. Analytics and site usage data

We use Google Analytics 4 to understand how the Site is used (for example: which pages are visited, which calculators are used, where visitors come from). Google Analytics is loaded only after you accept analytics cookies via our consent banner. If you decline, no analytics data is sent.

We also record functional events in your browser (such as page views and form interactions) using browser storage. These events may be sent to our own server in aggregated form, again only after you have given consent.

For full details of cookies and similar technologies we use, see our Cookie Policy.

Lawful basis: Article 6(1)(a) — your consent, given via the cookie banner.

5. Who we share your data with

We use a small number of trusted third-party service providers (called "processors") that help us operate the Site. These providers process personal data only on our instructions:

• Vercel Inc. — website hosting and serverless functions (USA, UK GDPR transfers covered by Standard Contractual Clauses and the UK Addendum)
• Neon Inc. — managed PostgreSQL database where form submissions and report sessions are stored
• Vercel Blob — file storage for generated mortgage report PDFs
• Resend — sends notification emails when you submit a form
• Stripe Payments UK Ltd — processes payments for paid embed subscriptions
• Google LLC (Google Analytics) — anonymised analytics, only loaded after you give cookie consent

We do not sell your personal data, and we do not share it with advertisers or data brokers.

If you submit a broker enquiry, we will pass the relevant information to a qualified, FCA-regulated mortgage broker. From that point, the broker is an independent data controller and will use your data under their own privacy notice. We will tell you which broker we are passing your details to before we do so where it is practical to do so.

6. International transfers

Some of our processors are based outside the UK (mainly in the United States). Where personal data is transferred outside the UK, we rely on the UK Government's adequacy regulations or on Standard Contractual Clauses with the UK International Data Transfer Addendum, as appropriate, to ensure your data is protected to UK GDPR standards.

7. How long we keep your data

8. Your rights

Under the UK GDPR you have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct data that is inaccurate or incomplete
• Erasure — ask us to delete your data ("right to be forgotten")
• Restriction — ask us to limit how we use your data
• Portability — ask us to send your data to you or another provider in a machine-readable format
• Objection — object to our use of your data where we rely on legitimate interests
• Withdraw consent — where processing is based on your consent, you can withdraw it at any time without affecting earlier processing

To exercise any of these rights, email us at privacy@bytesreality.com. We aim to respond to all requests within one month.

If you are not satisfied with how we handle your data, you have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk/concerns or by calling 0303 123 1113.

9. Children

The Site is not directed at children under 18, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

10. Security

We take reasonable technical and organisational measures to protect your personal data, including encryption in transit (HTTPS), encrypted database storage, access controls, and rate limiting on forms. However, no internet service can be guaranteed to be 100% secure. If we become aware of a personal data breach that affects you, we will notify you and the ICO as required by law.

11. Cookies

We use a small number of cookies and similar technologies. We will not load analytics or non-essential cookies until you accept them via the cookie banner. See our Cookie Policy for the full list.

12. Changes to this policy

We may update this Privacy Policy from time to time, for example if we add new features or change our processors. The "Last updated" date at the top of this page will always reflect the most recent version. For material changes, we will take reasonable steps to bring them to your attention.

13. Contact us

If you have any questions about this Privacy Policy or how we handle your data, please email privacy@bytesreality.com or use our contact form.